https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277736
Bug ID: 277736
Summary: llvm-objdump can crash due to
ELFFile<ELFT>::dynamicEntries() not checking p_offset
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: bin
Assignee: b...@freebsd.org
Reporter: r...@lcs.mit.edu
Created attachment 249216
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=249216&action=edit
a corrupt ELF file that causes llvm-objdump to crash
This line in llvm-project/llvm/lib/Object/ELF.cpp dynamicEntries()
forms a pointer from p_offset without checking whether it's too large:
Dyn = ArrayRef(reinterpret_cast<const Elf_Dyn *>(base() + Phdr.p_offset),
Phdr.p_filesz / sizeof(Elf_Dyn));
As a result a corrupt ELF file can cause objdump to crash. I've
attached a demo.
# uname -a
FreeBSD stock14 15.0-CURRENT FreeBSD 15.0-CURRENT #19
main-n268743-a58813fd701e: Sat Mar 9 07:18:21 AST 2024
root@stock14:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# objdump --version
LLVM (http://llvm.org/):
LLVM version 17.0.6
Optimized build with assertions.
..
# objdump -p ldd1b.exe
..
PLEASE submit a bug report to https://bugs.freebsd.org/submit/ and include the
crash backtrace.
Stack dump:
0. Program arguments: objdump -p ldd1b.exe
#0 0x0000000001230c41 PrintStackTrace
/usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:602:13
#1 0x000000000122f0b5 RunSignalHandlers
/usr/src/contrib/llvm-project/llvm/lib/Support/Signals.cpp:105:18
#2 0x0000000001231365 SignalHandler
/usr/src/contrib/llvm-project/llvm/lib/Support/Unix/Signals.inc:0:3
#3 0x00000008249cf5ff handle_signal /usr/src/lib/libthr/thread/thr_sig.c:0:3
#4 0x00000008249cebbb thr_sighandler
/usr/src/lib/libthr/thread/thr_sig.c:244:1
#5 0x000000082270d2d3 ([vdso]+0x2d3)
#6 0x0000000000f96641 dynamicEntries
/usr/src/contrib/llvm-project/llvm/lib/Object/ELF.cpp:590:24
#7 0x0000000000df2268 operator bool
/usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:559:17
#8 0x0000000000df2268 printDynamicSection
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:205:8
#9 0x0000000000df2268 printPrivateHeaders
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/ELFDump.cpp:431:3
#10 0x0000000000e6a13c dumpObject
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:2815:7
#11 0x0000000000e654b0 dumpInput
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:0:5
#12 0x0000000000e654b0
for_each<std::__1::__wrap_iter<std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > *>, void
(*)(llvm::StringRef)>
/usr/obj/usr/src/amd64.amd64/tmp/usr/include/c++/v1/__algorithm/for_each.h:26:5
#13 0x0000000000e654b0 for_each<std::__1::vector<std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >,
std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > > > &, void (*)(llvm::StringRef)>
/usr/src/contrib/llvm-project/llvm/include/llvm/ADT/STLExtras.h:1731:10
#14 0x0000000000e654b0 main
/usr/src/contrib/llvm-project/llvm/tools/llvm-objdump/llvm-objdump.cpp:3248:3
#15 0x0000000828a2d0aa __libc_start1 /usr/src/lib/libc/csu/libc_start1.c:157:2
Bus error (core dumped)
--
You are receiving this mail because:
You are the assignee for the bug.
